Harris D. Schwartz

Harris D. SchwartzAug 11, 2026

We don't have a cybersecurity problem. We have a decision-making problem. Most organizations have more security information than ever before. Threat intelligence. Vulnerability reports. Security alerts. Third-party assessments. Regulatory requirements. AI risks. Cloud exposure. The problem isn't a lack of information. It's what happens next. Who decides? What gets prioritized? What risk can the business accept? What needs immediate action? And who is accountable for the decision? I've worked with organizations where security teams had identified the risks months earlier. The problem wasn't visibility. The problem was that nobody could translate the information into a business decision. That's where cybersecurity leadership needs to evolve. A CISO shouldn't be expected to eliminate every risk. That's impossible. The role is to help the organization understand risk well enough to make informed decisions. That requires context. A critical vulnerability on a development server isn't necessarily the same risk as a moderate vulnerability on a system supporting a critical business process. A vendor with access to sensitive data isn't the same risk as a vendor with access to public information. An AI application isn't automatically dangerous. The risk depends on what it can access, how it's being used, and what controls surround it. Context changes the decision. That's why mature organizations are moving from: ❌ More alerts ❌ More reports ❌ More dashboards ❌ More risk scores Toward: ✓ Better context ✓ Clear ownership ✓ Business impact ✓ Defined risk appetite ✓ Faster decisions The goal isn't to fix everything. The goal is to understand what matters most and act accordingly. I believe the strongest security organizations operate as decision-support functions. They don't simply tell executives: "Here's your risk." They explain: "Here's what could happen, here's what it could cost, here's what we can do about it, and here's the decision we need to make." That's a very different conversation. And it's one that moves cybersecurity from a technical function into a true business discipline. The question I would ask every leadership team is: If we identified a significant cyber risk tomorrow, could we make a clear business decision about it within hours—not weeks? If the answer is no, you may not have a cybersecurity problem. You may have a decision-making problem. What gets in the way of fast cyber risk decisions in your organization: information, ownership, priorities, or risk appetite? #CyberSecurity #CyberResilience #Leadership #RiskManagement #CISO #Governance #CyberRisk #BusinessLeadership #DecisionMaking #InformationSecurity

Harris D. SchwartzAug 12, 2026

In April, something I had worked on for a long time finally became real. I published my first novel, The Homefront Directive. And now, just a few months later, I'm incredibly excited to share another milestone: The book now has international distribution. 🌎📚 What started as an idea, then became a manuscript, is now available to readers across the United States, United Kingdom, Europe, Australia, New Zealand, India, and international markets. That is a pretty incredible feeling. The Homefront Directive is a taut thriller exploring a very different side of the my professional background. The story brings together: → Domestic terrorism → Insider threats → Disgruntled employees → Intelligence operations → An investigation where the threat may be much closer than anyone realizes At the heart of the story is an intelligence agency tasked with uncovering what is really happening—and determining just how far the threat extends. I wanted to explore the uncomfortable intersection between insider threat, loyalty, intelligence, and the vulnerabilities that exist within organizations and communities. Writing fiction gave me the opportunity to take some of those concepts and put them into a completely different setting. There is something uniquely rewarding about seeing an idea that lived in your head become a physical book—and then watching it find its way onto bookshelves and into the hands of readers around the world. The book is now available through retailers including Barnes & Noble, Books-A-Million, Walmart, Bookshop.org, Waterstones, Blackwell's, bol.com, Hugendubel, Orell Füssli, Adlibris, Bokus, Saxo, LaFeltrinelli, Bookscape, The Nile, Fishpond, AbeBooks, and many others. I'll share the full list of retailers and regional links in the comments. To everyone who has already bought the book, recommended it, shared it, reviewed it, or encouraged me throughout the process: Thank you. A book starts with one person writing the words. But it becomes a story when other people read them. I'm excited to see where The Homefront Directive goes next. And maybe the biggest question is the one every good thriller should leave you asking: How well do you really know the people around you? #TheHomefrontDirective #PoliticalThriller #Thriller #Suspense #DomesticTerrorism #InsiderThreat #Espionage #Intelligence #CyberThriller #NewBook #Author #BookLaunch #Fiction

Harris D. SchwartzAug 24, 2026

We spent years worrying about employees putting sensitive data into AI. Now we need to start asking a much bigger question: What happens when AI can actually do something? AI is moving beyond chatbots and copilots. We're seeing AI systems that can: → Make decisions → Execute workflows → Write and deploy code → Access systems → Interact with customers → Trigger transactions → Change configurations → Act with limited human intervention That's a very different risk conversation. The question is no longer simply: "What information is the AI using?" It's: "What authority have we given it?" Think about the questions organizations need to answer: ✓ What can the AI access? ✓ What decisions can it make? ✓ What actions can it take without human approval? ✓ Who monitors those actions? ✓ Can we explain why it made a decision? ✓ Can we stop it quickly? ✓ Who owns the risk when it gets something wrong? And perhaps the most important question: Do we have a kill switch? AI governance cannot stop at policies about acceptable use. If an AI system can take action, governance needs to address authority, accountability, monitoring, testing, and resilience. This is where AI becomes an operational risk. An AI failure isn't necessarily just a bad answer. It could become: A financial loss. A customer-impacting event. A regulatory issue. A security incident. An operational disruption. Or a business continuity event. The organizations that get this right won't be the ones that simply deploy AI the fastest. They'll be the ones that understand what they're giving AI permission to do—and build guardrails around it. We've spent decades building controls around people and systems. Now we need to build them around machines that can make decisions and take action. The future of AI governance isn't just: "Can AI do this?" It's: "Should AI be allowed to do this—and under what conditions?" That's a very different question. And it's one every executive team needs to start asking now. If an AI agent made a decision tomorrow that could materially impact your business, could you stop it? #AI #AIGovernance #CyberSecurity #CyberResilience #RiskManagement #Leadership #ResponsibleAI #CISO #TechnologyLeadership #ArtificialIntelligence